ID. Date of interview 
date 95/02/20 


ID. — Time interview started 
start 46:21:40 


ID.end Completion date of interview 
Date 95/02/20 


ID.end Time interview ended 
17:10:52 


ID. Duration of interview 
time 49.20 


Start of new case 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don’t know, what other issues would you like to be covered in it? 


Q2 


Does the draft guidance contain the right level of detail? 


© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


Q3 


Does the draft guidance contain enough examples? 
© Yes 
—) No 

©) Unsure / don't know 

If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 


Q4 We have found that data protection professionals often struggle with applying and 
defining ‘manifestly 


unfounded or excessive’ subject access requests. We would like to include a wide 
range of examples 


from a variety of sectors to help you. Please provide some examples of manifestly 
unfounded and excessive 


requests below (if applicable). 


Q5 Ona scale of 1-5 how useful is the draft guidance? 


3- 
1-Notatall 2-—Slightly Moderately 4-Very 5- Extremely 


useful useful useful useful useful 


© © 


Q6 Why have you given this score? 


It covers most of the relevant parts of subject access request, including all the 
exemptions. For an inexperienced data protection professional it is clear and concise. 


More experienced professionals find that it does not cover the nuances of dealing 
with real people. 


Q7 To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly Neither agree Strongly 
disagree Disagree nor disagree Agree agree 


© O O © O 


Q8 


Q9 


Q10 


Please provide any further comments or suggestions you may have about the draft 
guidance. 


Can we clarify the request? (Page 23) If you process a large amount of information 
about an individual, you may ask them to specify the information or processing 
activities their request relates to before responding to the request. However, this 
does not affect the timescale for responding - you must still respond to their request 
within one month. Comment: This departs from current ICO guidance and presents 
practical challenges. Currently, the start of the time period to comply is delayed until 
receipt of any request for clarification. Under the draft guidance, the clock is still 
running whilst we wait for clarification from the requester. The time to respond has 
already been reduced to one month under GDPR (which is effectively anywhere 
between 28-30 days). If a requester then takes up to 10 days to respond, that 
would only leave 20 days to provide the requested personal data. This will be almost 
impossible, given the reason a controller will have asked for clarification in the first 
place, is because of the large volume of personal data we process. Do we have to 
respond to requests made via a third party online portal? (page 12) You are not 
obliged to take proactive steps to discover that a SAR has been made. Therefore, if 


Are you answering as: 

C) An individual acting in a private capacity (eg someone providing their views as a member of the public) 
(`) An individual acting in a professional capacity 

© On behalf of an organisation 

C) Other 

Please specify the name of your organisation: 

London Metropolitan University 

What sector are you from: 

Higher Education 


How did you find out about this survey? 
©) ICO Twitter account 

_) ICO Facebook account 

(`) ICO LinkedIn account 

©) ICO website 

( `) ICO newsletter 

(_) ICO staff member 

(`) Colleague 
( ) Personal/work Twitter account 
(`) Personal/work Facebook account 
(C) Personal/work LinkedIn account 
( ) Other 
If other please specify: 


